Are you sure about that? A lot of this stuff is way more than just some bored kid. For the company I work for, there is almost certainly a group of well paid people who sit around every day trying to figure out new ways run scams using our site.
When there is financial motivation, people go through great efforts to get that $$$.
"Security" isn't some catch-all box you can check. It's a non stop game of whack-a-mole where your adversary spends each day getting around whatever you put into place.
The software industry should be ten times bigger than it is, but the economic incentive has been to make it cost less, rather than to make it safer.
I feel this deeply within my soul.
I think it's actually harmful, because people that don't know any better thinks a Qualys scan means something.
The fact is that the correct and secure working of computer systems and networks has been severely neglected by companies in favor of their profit. If we are to have state response to such neglect, it should be funded by a huge tax on every copy of Windows.